att[.]japqo[.]icu

This domain, att.japqo.icu, is flagged for brand impersonation targeting X.com users with credential phishing tactics. The site presents a fraudulent login interface designed to harvest usernames and passwords by mimicking the authentic X.com platform. Visitors may unknowingly submit sensitive account details to attackers, leading to unauthorized access, account takeovers, or further malicious activities such as spam propagation or financial fraud. The threat is particularly insidious due to the domain’s plausible appearance and the use of a generic but deceptive page title, 'Welcome to nginx!', which may mislead users into believing the site is legitimate or under maintenance. Analysis indicates att.japqo.icu was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate services. The domain lacks an SSL certificate, a critical red flag for any site handling user credentials, and resolves to the IP address 104.21.51.29, hosted on Cloudflare’s infrastructure (AS13335). VirusTotal reports 18 out of 95 security vendors have flagged this domain as malicious, with one security blocklist already listing it. The combination of a future creation date, absence of encryption, and low vendor detection suggests an attempt to evade automated security systems while targeting unsuspecting users. If you visited att.japqo.icu or entered credentials on the site, immediate action is required. First, change your X.com password using a secure device and enable multi-factor authentication if not already active. Monitor your account for unauthorized posts, messages, or linked applications, and revoke access to any unfamiliar third-party services. Check connected email accounts for password reset attempts or suspicious activity, as attackers may pivot to other platforms. Report the incident to X.com’s support team and consider running a full antivirus scan on the device used to access the site to rule out malware infections. Avoid reusing passwords across services, and verify domain authenticity before entering credentials in the future.